Add pipeline to compute Advisory ToDos

vulnerabilities/improvers/__init__.py

@@ -12,6 +12,7 @@
 from vulnerabilities.pipelines import VulnerableCodePipeline
 from vulnerabilities.pipelines import add_cvss31_to_CVEs
 from vulnerabilities.pipelines import collect_commits
+from vulnerabilities.pipelines import compute_advisory_todo
 from vulnerabilities.pipelines import compute_package_risk
 from vulnerabilities.pipelines import compute_package_version_rank
 from vulnerabilities.pipelines import enhance_with_exploitdb
@@ -45,6 +46,7 @@
     compute_package_version_rank.ComputeVersionRankPipeline,
     collect_commits.CollectFixCommitsPipeline,
     add_cvss31_to_CVEs.CVEAdvisoryMappingPipeline,
+    compute_advisory_todo.ComputeToDo,
 ]
 
 IMPROVERS_REGISTRY = {

vulnerabilities/migrations/0089_advisorytodo.py

@@ -0,0 +1,99 @@
+# Generated by Django 4.2.17 on 2025-01-27 18:04
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("vulnerabilities", "0088_fix_alpine_purl_type"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="AdvisoryToDo",
+            fields=[
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True, primary_key=True, serialize=False, verbose_name="ID"
+                    ),
+                ),
+                (
+                    "related_advisories_id",
+                    models.CharField(
+                        help_text="SHA1 digest of the unique_content_id field of the applicable advisories.",
+                        max_length=40,
+                    ),
+                ),
+                (
+                    "issue_type",
+                    models.CharField(
+                        choices=[
+                            ("MISSING_AFFECTED_PACKAGE", "Advisory is missing affected package"),
+                            ("MISSING_FIXED_BY_PACKAGE", "Advisory is missing fixed-by package"),
+                            (
+                                "MISSING_AFFECTED_AND_FIXED_BY_PACKAGES",
+                                "Advisory is missing both affected and fixed-by packages",
+                            ),
+                            ("MISSING_SUMMARY", "Advisory is missing summary"),
+                            (
+                                "CONFLICTING_FIXED_BY_PACKAGES",
+                                "Advisories have conflicting fixed-by packages",
+                            ),
+                            (
+                                "CONFLICTING_AFFECTED_PACKAGES",
+                                "Advisories have conflicting affected packages",
+                            ),
+                            (
+                                "CONFLICTING_AFFECTED_AND_FIXED_BY_PACKAGES",
+                                "Advisories have conflicting affected and fixed-by packages",
+                            ),
+                            (
+                                "CONFLICTING_SEVERITY_SCORES",
+                                "Advisories have conflicting severity scores",
+                            ),
+                        ],
+                        db_index=True,
+                        help_text="Select the issue that needs to be addressed from the available options.",
+                        max_length=50,
+                    ),
+                ),
+                ("issue_detail", models.TextField(help_text="Additional details about the issue.")),
+                (
+                    "created_at",
+                    models.DateTimeField(
+                        auto_now_add=True,
+                        help_text="Timestamp indicating when this TODO was created.",
+                    ),
+                ),
+                (
+                    "is_resolved",
+                    models.BooleanField(
+                        db_index=True, default=False, help_text="This TODO is resolved or not."
+                    ),
+                ),
+                (
+                    "resolved_at",
+                    models.DateTimeField(
+                        help_text="Timestamp indicating when this TODO was resolved."
+                    ),
+                ),
+                (
+                    "resolution_detail",
+                    models.TextField(help_text="Additional detail on how this TODO was resolved."),
+                ),
+                (
+                    "advisories",
+                    models.ManyToManyField(
+                        help_text="Advisory/ies where this TODO is applicable.",
+                        related_name="advisory_todos",
+                        to="vulnerabilities.advisory",
+                    ),
+                ),
+            ],
+            options={
+                "unique_together": {("related_advisories_id", "issue_type")},
+            },
+        ),
+    ]

vulnerabilities/models.py

@@ -1799,3 +1799,76 @@ class CodeFix(CodeChange):
         related_name="code_fix",
         help_text="The fixing package version with this code fix",
     )
+
+
+ISSUE_TYPE_CHOICES = [
+    ("MISSING_AFFECTED_PACKAGE", "Advisory is missing affected package"),
+    ("MISSING_FIXED_BY_PACKAGE", "Advisory is missing fixed-by package"),
+    (
+        "MISSING_AFFECTED_AND_FIXED_BY_PACKAGES",
+        "Advisory is missing both affected and fixed-by packages",
+    ),
+    ("MISSING_SUMMARY", "Advisory is missing summary"),
+    ("CONFLICTING_FIXED_BY_PACKAGES", "Advisories have conflicting fixed-by packages"),
+    ("CONFLICTING_AFFECTED_PACKAGES", "Advisories have conflicting affected packages"),
+    (
+        "CONFLICTING_AFFECTED_AND_FIXED_BY_PACKAGES",
+        "Advisories have conflicting affected and fixed-by packages",
+    ),
+    ("CONFLICTING_SEVERITY_SCORES", "Advisories have conflicting severity scores"),
+]
+
+
+class AdvisoryToDo(models.Model):
+    """Track the TODOs for advisory/ies that need to be addressed."""
+
+    # Since we can not make advisories field (M2M field) unique
+    # (see https://code.djangoproject.com/ticket/702), we use related_advisories_id
+    # to avoid creating duplicate issue for same set of advisories,
+    related_advisories_id = models.CharField(
+        max_length=40,
+        blank=False,
+        null=False,
+        help_text="SHA1 digest of the unique_content_id field of the applicable advisories.",
+    )
+
+    issue_type = models.CharField(
+        max_length=50,
+        choices=ISSUE_TYPE_CHOICES,
+        blank=False,
+        null=False,
+        db_index=True,
+        help_text="Select the issue that needs to be addressed from the available options.",
+    )
+
+    issue_detail = models.TextField(
+        help_text="Additional details about the issue.",
+    )
+
+    advisories = models.ManyToManyField(
+        Advisory,
+        related_name="advisory_todos",
+        help_text="Advisory/ies where this TODO is applicable.",
+    )
+
+    created_at = models.DateTimeField(
+        auto_now_add=True,
+        help_text="Timestamp indicating when this TODO was created.",
+    )
+
+    is_resolved = models.BooleanField(
+        default=False,
+        db_index=True,
+        help_text="This TODO is resolved or not.",
+    )
+
+    resolved_at = models.DateTimeField(
+        help_text="Timestamp indicating when this TODO was resolved.",
+    )
+
+    resolution_detail = models.TextField(
+        help_text="Additional detail on how this TODO was resolved.",
+    )
+
+    class Meta:
+        unique_together = ("related_advisories_id", "issue_type")